Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

contrid — Vulnerabilities & Security Advisories 13

Browse all 13 CVE security advisories affecting contrid. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Contrid is a content management system primarily used for building and managing websites, particularly in small to medium-sized businesses. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, accounting for its eight recorded CVEs. The platform's security characteristics include frequent input validation weaknesses and insufficient access controls, with notable incidents involving authenticated RCE through improper sanitization of user-supplied parameters. While no major public breaches have been widely documented, its consistent vulnerability pattern suggests ongoing challenges in secure coding practices, particularly in handling user data and authentication mechanisms.

CVE ID Title CVSS Severity Published
CVE-2026-75908 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter — Newsletters CWE-862 4.3 Medium 2026-08-25
CVE-2026-12939 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute — Newsletters CWE-79 6.4 Medium 2026-07-29
CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute — Newsletters CWE-79 6.4 Medium 2026-07-29
CVE-2026-2021 Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute — Slideshow Gallery LITE CWE-79 6.4 Medium 2026-06-18
CVE-2026-3018 Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter — Newsletters CWE-89 7.5 High 2026-06-10
CVE-2025-4857 Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion — Newsletters CWE-22 7.2 High 2025-05-31
CVE-2025-3107 Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter — Newsletters CWE-89 6.5 Medium 2025-05-13
CVE-2025-2009 Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting — Newsletters CWE-79 7.2 High 2025-03-26
CVE-2024-13739 Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter — Newsletters CWE-79 6.1 Medium 2025-03-22
CVE-2024-10181 Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode — Newsletters CWE-79 6.4 Medium 2024-10-29
CVE-2024-8247 Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation — Newsletters CWE-269 8.8 High 2024-09-06
CVE-2024-7411 Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure — Newsletters CWE-200 5.3 Medium 2024-08-15
CVE-2024-5543 Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection — Slideshow Gallery LITE CWE-89 8.1 High 2024-06-12

This page lists every published CVE security advisory associated with contrid. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.